[Bugfix #242] Review document

[pseudoseed]

The review artifact for #242, which PR #282 merged without. Documentation only — no code.

Refs #242

Records the root cause, what the CMAP lanes caught, and five things worth keeping:

• The label check is a whitelist because a bare .. cannot escape here, so a .. blocklist would
  have tested clean while x/../.. walked past it.
• The first port guard failed open: [ "$PORT" -lt 1 ] on a 30-digit port returns 2, which an if
  reads as false, so the run continued to an unrelated refusal. Found by the codex lane.
• Bash defers a trap until the current foreground command returns, so the runner had to become a
  background job for the trap to be a fix rather than a decoration.
• The stub runner leaked a sleep past every signal test until it slept under its own trap.
• The blocker in the issue was already paid: the evidence hash had been superseded on 2026-08-30.

It also names what was deliberately left: #283 (grandchildren), the unbounded wait, and the two
environmental items (#278, and the single-socket vitest suite lock shared across worktrees).

[pseudoseed]

The review artifact for #242, which PR #282 merged without. Documentation only — no code.

Refs #242

Records the root cause, what the CMAP lanes caught, and five things worth keeping:

• The label check is a whitelist because a bare .. cannot escape here, so a .. blocklist would
  have tested clean while x/../.. walked past it.
• The first port guard failed open: [ "$PORT" -lt 1 ] on a 30-digit port returns 2, which an if
  reads as false, so the run continued to an unrelated refusal. Found by the codex lane.
• Bash defers a trap until the current foreground command returns, so the runner had to become a
  background job for the trap to be a fix rather than a decoration.
• The stub runner leaked a sleep past every signal test until it slept under its own trap.
• The blocker in the issue was already paid: the evidence hash had been superseded on 2026-08-30.

It also names what was deliberately left: #283 (grandchildren), the unbounded wait, and the two
environmental items (#278, and the single-socket vitest suite lock shared across worktrees).

[pseudoseed]

The review artifact for #242, which PR #282 merged without. Documentation only — no code.

Refs #242

Records the root cause, what the CMAP lanes caught, and five things worth keeping:

• The label check is a whitelist because a bare .. cannot escape here, so a .. blocklist would
  have tested clean while x/../.. walked past it.
• The first port guard failed open: [ "$PORT" -lt 1 ] on a 30-digit port returns 2, which an if
  reads as false, so the run continued to an unrelated refusal. Found by the codex lane.
• Bash defers a trap until the current foreground command returns, so the runner had to become a
  background job for the trap to be a fix rather than a decoration.
• The stub runner leaked a sleep past every signal test until it slept under its own trap.
• The blocker in the issue was already paid: the evidence hash had been superseded on 2026-08-30.

It also names what was deliberately left: #283 (grandchildren), the unbounded wait, and the two
environmental items (#278, and the single-socket vitest suite lock shared across worktrees).

[pseudoseed]

The review artifact for #242, which PR #282 merged without. Documentation only — no code.

Refs #242

Records the root cause, what the CMAP lanes caught, and five things worth keeping:

• The label check is a whitelist because a bare .. cannot escape here, so a .. blocklist would
  have tested clean while x/../.. walked past it.
• The first port guard failed open: [ "$PORT" -lt 1 ] on a 30-digit port returns 2, which an if
  reads as false, so the run continued to an unrelated refusal. Found by the codex lane.
• Bash defers a trap until the current foreground command returns, so the runner had to become a
  background job for the trap to be a fix rather than a decoration.
• The stub runner leaked a sleep past every signal test until it slept under its own trap.
• The blocker in the issue was already paid: the evidence hash had been superseded on 2026-08-30.

It also names what was deliberately left: #283 (grandchildren), the unbounded wait, and the two
environmental items (#278, and the single-socket vitest suite lock shared across worktrees).

[pseudoseed]

The review artifact for #242, which PR #282 merged without. Documentation only — no code.

Refs #242

Records the root cause, what the CMAP lanes caught, and five things worth keeping:

• The label check is a whitelist because a bare .. cannot escape here, so a .. blocklist would
  have tested clean while x/../.. walked past it.
• The first port guard failed open: [ "$PORT" -lt 1 ] on a 30-digit port returns 2, which an if
  reads as false, so the run continued to an unrelated refusal. Found by the codex lane.
• Bash defers a trap until the current foreground command returns, so the runner had to become a
  background job for the trap to be a fix rather than a decoration.
• The stub runner leaked a sleep past every signal test until it slept under its own trap.
• The blocker in the issue was already paid: the evidence hash had been superseded on 2026-08-30.

It also names what was deliberately left: #283 (grandchildren), the unbounded wait, and the two
environmental items (#278, and the single-socket vitest suite lock shared across worktrees).

[pseudoseed]

The review artifact for #242, which PR #282 merged without. Documentation only — no code.

Refs #242

Records the root cause, what the CMAP lanes caught, and five things worth keeping:

• The label check is a whitelist because a bare .. cannot escape here, so a .. blocklist would
  have tested clean while x/../.. walked past it.
• The first port guard failed open: [ "$PORT" -lt 1 ] on a 30-digit port returns 2, which an if
  reads as false, so the run continued to an unrelated refusal. Found by the codex lane.
• Bash defers a trap until the current foreground command returns, so the runner had to become a
  background job for the trap to be a fix rather than a decoration.
• The stub runner leaked a sleep past every signal test until it slept under its own trap.
• The blocker in the issue was already paid: the evidence hash had been superseded on 2026-08-30.

It also names what was deliberately left: #283 (grandchildren), the unbounded wait, and the two
environmental items (#278, and the single-socket vitest suite lock shared across worktrees).

[pseudoseed]

The review artifact for #242, which PR #282 merged without. Documentation only — no code.

Refs #242

Records the root cause, what the CMAP lanes caught, and five things worth keeping:

• The label check is a whitelist because a bare .. cannot escape here, so a .. blocklist would
  have tested clean while x/../.. walked past it.
• The first port guard failed open: [ "$PORT" -lt 1 ] on a 30-digit port returns 2, which an if
  reads as false, so the run continued to an unrelated refusal. Found by the codex lane.
• Bash defers a trap until the current foreground command returns, so the runner had to become a
  background job for the trap to be a fix rather than a decoration.
• The stub runner leaked a sleep past every signal test until it slept under its own trap.
• The blocker in the issue was already paid: the evidence hash had been superseded on 2026-08-30.

It also names what was deliberately left: #283 (grandchildren), the unbounded wait, and the two
environmental items (#278, and the single-socket vitest suite lock shared across worktrees).

[pseudoseed]

The review artifact for #242, which PR #282 merged without. Documentation only — no code.

Refs #242

Records the root cause, what the CMAP lanes caught, and five things worth keeping:

• The label check is a whitelist because a bare .. cannot escape here, so a .. blocklist would
  have tested clean while x/../.. walked past it.
• The first port guard failed open: [ "$PORT" -lt 1 ] on a 30-digit port returns 2, which an if
  reads as false, so the run continued to an unrelated refusal. Found by the codex lane.
• Bash defers a trap until the current foreground command returns, so the runner had to become a
  background job for the trap to be a fix rather than a decoration.
• The stub runner leaked a sleep past every signal test until it slept under its own trap.
• The blocker in the issue was already paid: the evidence hash had been superseded on 2026-08-30.

It also names what was deliberately left: #283 (grandchildren), the unbounded wait, and the two
environmental items (#278, and the single-socket vitest suite lock shared across worktrees).